How Can the Automotive Industry Strengthen Its Regulatory Compliance Process and Reduce Its Compliance Risks?

Many Americans listened last week to the admissions by the now former President of Volkswagen that the company had been “dishonest” and had cheated on the U.S. emissions tests.  How was this happening at the world’s #1 carmaker and a company trusted for its engineering?   

The news kept coming:  VW may be confronting US$16 billion – US$18 billion in fines for environmental violations affecting 482,000 cars in the United States, and as many as 11 million cars worldwide.  VW has set aside US$7.3 billion to cover costs of these violations.  The U.S. Department of Justice (DOJ) announced that it would seek to prosecute individual VW executives.  The U.S. Congress has announced its intention to investigate the fraud, including public hearings on the alleged transgressions.  The European Union is launching investigations.  The VW stock price fell 30% on the first business day after the U.S. Environmental Protection Agency (EPA) made its announcement and is continuing its downward spiral.  On the third business day after the news, the VW CEO resigned.  Headlines are reporting deception and fraud with serious consequences to VW of crisis proportions.

These events were triggered by announcements on September 18, 2015, by the EPA and the California Air Resources Board that VW used software in its cars to make diesel-powered engines appear to have lower levels of emission than they actually did.   

VW is not the only automotive company in the headlines recently for regulatory violations.  U.S. authorities responsible for regulating different aspects of the automotive industry have been more aggressive and active in the recent past when confronted by potential violations of their regulatory frameworks.  Just a few weeks ago, the DOJ announced a settlement of criminal charges against General Motors (GM) and the financial costs to GM have been in the billions.  Also, in July 2015, Fiat Chrysler Automobiles acknowledged violations of the Motor Vehicle Safety Act and agreed to pay US$105 million in civil penalty to the National Highway and Traffic Safety Administration (NHTSA) and to hire an independent monitor.  Several Japanese auto manufacturers have also come under scrutiny by the NHTSA and DOJ in recent years, resulting in civil and financial penalties.  In addition to the financial toll to these companies there is also reputational and brand equity damage associated with the news, both for the individual companies involved and the industry as a whole.

Global Compliance Risk Solutions 
Governments have heightened their oversight of regulatory compliance across many industries.  Indeed, European regulators responded to the VW scandal by pledging to modify their emissions testing protocols.  These headlines are a wake-up call to the automotive industry that senior management and corporate boards need to reconsider their existing compliance processes and, where found lacking, develop a robust, dynamic risk-based approach throughout the organization to fully address regulatory compliance and related reputational risks.    

Automakers may want to undertake such a review and to consider an approach that the financial services industry has embraced by making the management of compliance risks a top priority on par with other major strategic, financial, and operational risks.  The fundamental elements of an effective compliance program are common across regulated industries and, although there are many differences between industries, the conceptual elements used within the financial services industry in its compliance programs may be helpful in providing a fresh approach for the auto industry to conceptualize an effective compliance plan relevant to vehicle safety and environmental laws.

Sample Compliance Process
(a) Each automaker and auto component manufacturer may wish to implement or strengthen the following compliance process elements:

(1)  Compliance Risk Assessment.  Conduct a risk assessment to identify laws related to vehicle safety, environmental protection and other areas relevant to the company’s business globally (which we refer to as Relevant Automotive Laws).   

• This risk assessment would include a risk-based approach to identifying laws that pose material compliance risks.  Some of these laws with significant risks may be strictly automotive and some, such as antitrust and anti-bribery laws, may be of general applicability. 
• Those laws that regulate vehicle safety and environment clearly carry high compliance risks for the auto industry.  They include, in the United States, the Motor Vehicle Safety Act, the TREAD Act, the Clean Air Act, and the regulations of NHTSA and the EPA, and in the European Union, the Product Safety Act, Road Traffic Licensing Regulation, Federal Emission Control Act, Vehicle Regulations of the United Nations Economic Commission for Europe (UNECE Regulations) and European Regulations, in particular the Euro 5 and Euro 6-Regulation on emissions.

(2)  Policies and Procedures. Adopt and implement written policies and procedures reasonably designed to prevent violation of the Relevant Automotive Laws.

• The policies and procedures are most effective when crafted to the specific business model and dynamics of the company.  General, off-the-shelf versions of policies and procedures lack the rigor and detail necessary to anticipate specific company needs and structures.  In addition, the process of developing policies and procedures engages all stakeholders in assuring a complete, robust and dynamic program that fits within the company’s operations.
• This initial risk assessment can be expected to change, with changes in laws and changes in the company’s business, and will benefit from regular monitoring and periodic updates to ensure that the compliance program continues to address the company’s significant compliance risks.   
• Provide for training of critical personnel and periodic audits of the process, which can be facilitated by an internal risk office as well as internal and outside counsel and consultants.

(3) Board Approval. Obtain the approval of the company's policies and procedures by the company's board of directors, including, where relevant, a majority of directors who are not interested persons of the company based on a finding by the board that the policies and procedures are reasonably designed to prevent violations of the Relevant Automotive Laws.

• Board involvement, particularly by the independent directors, ensures the impartiality and company conduct consistent with the best interests of the company and its shareholders.

(4) Annual Review. Review, no less frequently than annually, the adequacy of the policies and procedures of the company and the effectiveness of their implementation, training, and audits.

(5) Chief Compliance Officer. Designate an individual responsible for administering the company's policies and procedures, who is impartial and not subject to undue influence.

• A CCO reporting directly to the board of directors would generally provide an annual written report to the board. 
• Typically, the report would address the operation of the policies and procedures of the company, any material changes made to those policies and procedures since the date of the last report, and any material changes to the policies and procedures recommended as a result of the annual review, as well as any material compliance matter that occurred since the date of the last report about which the company's board of directors would reasonably need to know to oversee company compliance. 
• A material compliance matter would include (i) a violation or potential violation of a Relevant Automotive Law by the company or its officers, directors, employees or agents, (ii) a violation or potential violation of the policies and procedures of the company, or (iii) a weakness in the design, implementation, training or audit of the policies and procedures of the company.

Implicit and explicit in the above sample process are three outcomes:  (i) implement clear, streamlined, focused compliance policies and procedures; (ii) appoint a senior management person who can be impartial and reports to the board of directors; and (iii) report material compliance risks to the board of directors.  This sample process would be an elevated and sophisticated treatment of an automaker’s compliance process.  

In sum, this sample process is not a universal solution and each company must custom tailor its solution to its own structure and its already-existing processes to make the end process as robust as possible to support a compliance-based culture within the organization.  The auto industry will need to be prepared to answer questions from the governments in the countries where they do business relating to their practices regarding emissions and other matters.  An up-to-date review of current practices and a coherent plan for making necessary changes will position each automaker in the best way possible to deal with the likely scrutiny.

*Grace Parke Fremlin, Diane E. Ambler and Russell Abrams are partners at K&L Gates.  Ms. Fremlin and Mr. Abrams have extensive experience with automotive clients, and Ms. Ambler is a leader in financial regulatory compliance risk management processes.